T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:94
- Finding
- Unpinned and Unverified Third-Party Package and Skill Installation## Vulnerability Details **File Location**: `SKILL.md:94`, `SKILL.md:101-104`, and `SKILL.md:161` **Vulnerability Type**: Unverified and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:94 npm install -g clawhub uv ``` ```bash # SKILL.md:101-104 # Install official skills clawhub install clawhub find-skills skill-creator clawddocs openclaw-anything clawdbot-filesystem ontology # Install enhanced skills clawhub install session-monitor task-persistence ``` ```markdown <!-- SKILL.md:161 --> 1. **Regular Updates**: `clawhub update --all` ``` ### Technical Analysis The deployment guide directs users to install global npm packages and nine additional OpenClaw Skills without pinning exact versions, immutable commit identifiers, or content hashes. It also does not specify canonical source URLs, verified publishers, package signatures, checksums, or a review procedure before activation. Consequently, the effective code and instructions installed by these commands can change after this Skill has been audited. The recommendation to run `clawhub update --all` further expands this trust boundary by accepting mutable releases of every installed Skill in bulk. Although the document describes some dependencies as official, it provides no locally verifiable provenance. An upstream account compromise, registry compromise, dependency-confusion condition, malicious package replacement, or unexpected future release could therefore introduce attacker-controlled behavior. The global npm installation may increase the affected host scope depending on the privileges and npm configuration used to execute it. ### Attack Path 1. An attacker compromises a publisher account, package registry entry, Skill distribution channel, or another upstream component associated with one of the named dependencies. 2. The attacker publishes a malicious package or Skill under a version that the unpinned installation or update command will select. 3. A ...[truncated 1534 chars]
- Remediation
- ## Remediation Suggestions 1. **Pin immutable dependency versions** - Specify exact npm package versions rather than resolving the latest release. - Pin each Skill to an immutable version, commit identifier, or content digest where supported. - Store the reviewed dependency set in a lockfile or equivalent manifest. 2. **Verify package provenance** - Document canonical registry and repository URLs. - Identify expected publishers or organization accounts. - Require package signature, provenance attestation, or checksum verification before installation. - Publish expected hashes through a separate trusted channel. 3. **Avoid automatic bulk updates** - Replace `clawhub update --all` with individually reviewed upgrades. - Review release notes and source changes before updating each Skill. - Test updates in an isolated staging environment before production activation. 4. **Reduce installation privileges** - Avoid privileged or root execution for global npm installation. - Prefer a dedicated user account, project-local installation, container, or other isolated environment. - Restrict filesystem, network, credential, and system-management access to the minimum required by each Skill. 5. **Review Skills before activation** - Inspect each downloaded Skill's instructions, scripts, dependency declarations, and requested capabilities. - Reject Skills that retrieve mutable remote payloads or request permissions unrelated to their documented purpose. - Maintain an explicit allowlist of reviewed Skill names and pinned versions. 6. **Add rollback and monitoring controls** - Back up configuration and known-good Skill versions before upgrades. - Log package installation, Skill activation, and update events. - Monitor for unexpected filesystem, network, configuration, and persistence changes after installation.